修改用户设置的新增用户的权限点击操作

backend/app/db/platform_store.py

@@ -555,6 +555,8 @@ class PlatformStore:
                 extra_path = schema_dir / extra
                 if extra_path.exists():
                     conn.executescript(extra_path.read_text(encoding="utf-8"))
+            # data_convert_tasks 表补充 created_by 字段（用于数据隔离）
+            self._ensure_columns(conn, "data_convert_tasks", {"created_by": "TEXT"})
 
     def _column_names(self, conn: PgConnection, table_name: str) -> set[str]:
         columns = conn.execute(
@@ -1285,7 +1287,13 @@ class PlatformStore:
 
     def create_user(self, payload: dict[str, Any]) -> dict[str, Any]:
         user_id = new_id("u")
-        permissions = payload.get("permissions") or (ALL_PERMISSIONS if payload.get("role") == "admin" else ["dashboard"])
+        role = payload.get("role", "user")
+        if role == "admin":
+            permissions = ALL_PERMISSIONS
+        else:
+            # 普通用户：默认拥有所有业务权限，仅排除 user-settings 和 compute
+            role = "user"
+            permissions = [p for p in ALL_PERMISSIONS if p not in ("user-settings", "compute")]
         with self.connect() as conn:
             conn.execute(
                 """
@@ -1298,7 +1306,7 @@ class PlatformStore:
                     payload["username"],
                     hash_password(payload.get("password", "platform123")),
                     payload.get("display_name") or payload["username"],
-                    payload.get("role", "viewer"),
+                    role,
                     payload.get("status", "active"),
                     json_dumps(permissions),
                     utcnow(),
@@ -1318,8 +1326,8 @@ class PlatformStore:
                     # 管理员权限不可更改，必须是全部
                     perms = ALL_PERMISSIONS
                 else:
-                    # 非 admin 用户不能拥有 user-settings 权限
-                    perms = [p for p in (perms or []) if p != "user-settings"]
+                    # 非 admin 用户不能拥有 user-settings 和 compute 权限
+                    perms = [p for p in (perms or []) if p not in ("user-settings", "compute")]
                 payload = {**payload, "permissions": perms}
             values = {
                 "role": payload.get("role", row["role"]),

backend/app/db/sql/002_governance.sql

@@ -51,10 +51,18 @@ CREATE TABLE IF NOT EXISTS audit_logs (
     time TEXT
 );
 
-CREATE INDEX IF NOT EXISTS idx_audit_tenant ON audit_logs(tenant_id);
-CREATE INDEX IF NOT EXISTS idx_audit_project ON audit_logs(project_id);
-CREATE INDEX IF NOT EXISTS idx_audit_action ON audit_logs(action);
-CREATE INDEX IF NOT EXISTS idx_audit_time ON audit_logs(time);
+-- 幂等升级 audit_logs 表：新增字段（已存在则跳过）
+ALTER TABLE audit_logs ADD COLUMN IF NOT EXISTS trace_id TEXT;
+ALTER TABLE audit_logs ADD COLUMN IF NOT EXISTS request_method TEXT;
+ALTER TABLE audit_logs ADD COLUMN IF NOT EXISTS request_path TEXT;
+ALTER TABLE audit_logs ADD COLUMN IF NOT EXISTS status_code INTEGER;
+ALTER TABLE audit_logs ADD COLUMN IF NOT EXISTS duration_ms REAL;
+ALTER TABLE audit_logs ADD COLUMN IF NOT EXISTS extra JSONB;
+
+-- 索引（已存在则跳过）
+CREATE INDEX IF NOT EXISTS idx_audit_trace ON audit_logs(trace_id);
+CREATE INDEX IF NOT EXISTS idx_audit_actor_time ON audit_logs(actor_id, time);
+CREATE INDEX IF NOT EXISTS idx_audit_target ON audit_logs(target_type, target_id);
 
 CREATE TABLE IF NOT EXISTS retention_policies (
     id TEXT PRIMARY KEY,